Posted on August 19, 2010
Gone Phishing
During the past few weeks, I've been contacted by a couple of friends/clients regarding the legitimacy of emails that seemed a bit fishy. I'm glad both were savvy enough to trust their instincts and question the emails before proceeding further.
Four quick tips to keep your identity & passwords safe from 'phishermen'
- NEVER follow the link provided in a suspicious email
- ALWAYS go directly to the correct source
- LOOK for bad grammar and typos
- REPORT the scam attempt to spam@uce.gov
Verify = Victim?
Over the last few years, scam artists have gotten more and more sophisticated in their attempts to pry your personal information from you. Legitimate looking emails claiming to be from a bank, eBay, or PayPal asking for account verification have probably hit your email box several dozen times. Scammers will try different tactics; to confirm an order or stating that your account may have been compromised... Ignore them!
NEVER click the link a suspicious email provides. While they may appear to be authentic, the convenient link usually leads to a shadow site built for the express purpose of skimming your account information.
An easy way to check whether a link is fraudulent: hover your cursor over it and see what shows up in the status bar at the bottom of the browser. Typically the URL in your status bar has no relation to the URL displayed in the email.
Craigslist Scams
So this brings up the first fishy email. One of my agent clients received the following official looking email, purportedly from Craigslist - even including their logo!
Posting Account Sign Up Form
Craigslist decided to check all seller accounts in database. If we wish to keep this account will have to submit to new rules from craigslist.
You need to Click Here (link removed) to verify your account.
The department customer will answer soon with additional information about
your account.
Thank you for understanding
Taking these simple precautions helps make craigslist safer for everyone. 
Craigslist has been a great free resource to buy and sell local goods on-line. Many real estate agents utilize the site to post active listings, rental properties and announce open houses. Consumers know this. Unfortunately, the scammers do too. So much so that now, that in big, bold letters on Craigslists' account login page, they have the following warning:
WARNING: scammers may try to steal your account by sending an official-looking email with a link to a fake craigslist login page that looks like this page, hoping you'll type in your username and password. Look carefully at the web address near the top of your browser to make sure you are on the real craigslist login page, https://accounts.craigslist.org
Too Good To Be True?
The second fishy email discussed this week was from someone looking to rent a house.
They responded to an ad for a 3 bedroom house in Kenmore for $800/per month, utilities included!! (Red Flag 1) Way below current rental values.
The reply back indicated that the owner was a doctor/professor out of the country (Red Flag 2) The house description & address provided was vague (Red Flag #3) and there was urgency in collecting funds to hold the home for you (Red Flag #4). Fortunately, she checked with friends because something in the back of her head said "This can't be right!" But how many people considered placing a deposit or paying for a credit check towards this fantastic deal for rental house?
8/30/10 Update! Sammamish Man Charged in Rental Scam This may not be the same scam as noted above, but from the Seattle Times article, you can see the similarities on how these types of crimes are committed.
Flag the Fraudster!
Craigslist has a method for flagging posts that are fraudulent. Look for the "Flag This Post" icon at the top of the page. They will remove suspicious postings.
To stop e-scammers from perpetuating phishing scams, report it - forward the email to
spam@uce.gov and the actual business' fraud department. Visit the homepage of the bank or business, They should have a link to their privacy & security policy and usually have a link to the email address - something like abuse @companyname.com to report a phishing attempt.
For more information, visit
Hope these quick tips help to remind you to listen to your inner voice - it's usually right!